Hi, everyone, and welcome back.
Now, in today's video, we will be discussing about the proxy host header.
Now, by default, the host header that is received at a reverse proxy level is not really forwarded
to the backend server.
For example, let's say that you have a web browser.
A web browser is making a request to the website and the request first reaches the Nginx reverse proxy.
Now the request is of type get and there is a host header of captain.
So basically the user is requesting for a website called as Captain.
So this request goes to the Nginx reverse proxy and depending upon the proxy configuration that you
have done, Nginx will send the same request to the backend server.
Now if you look into the request that is made to the backend server, it is again a get request.
That was the original one.
However, this host field here is missing now based on this setup, even if the host fill is missing,
it might not really impact much.
However, when you have a backend that is hosting multiple applications or multiple websites, then
you will run into issues.
So let's quickly look into it.
Now if you look here, the backend web server is hosting two different websites.
One is captain and second is CPT Net, and both of them have a different index.html file altogether.
So now your web browser has requested for CPT net.
The request is received at nginx reverse proxy level.
Nginx reverse proxy is just sending the get request to the web server.
Now this web server does not really know whether it should serve the index.html of captain or index.html
of CPT net because this host header is missing over here and this is one of the reasons why it is very
important that the host header that was sent by the client should also be forwarded to the backend application.
Specifically when you have multiple domain based association that is taking place here.
So let's quickly look into it.
Now let's do one thing.
Let's quickly run our inspect within the browser and let's request for the Dexter Labs dot in.
All right, so the website is loaded.
Now, one important part to note is that sometimes the user complain that a website is not loading primarily
because when you just type domain, many times the Chrome will directly add the https here.
So this is the reason why the domain might not load.
So you have to ensure that it is not a Https, it is just the Http based request anyways.
So let's quickly go to network and if you quickly look into the headers here, let's quickly look into
the request headers.
You have a host header and the host header is Dexter Labs dot in.
So this is the host header which reaches this Nginx level here.
And this Nginx does not forward it to the backend server and we want that.
Nginx should also forward it to the backend server.
So for this to be achieved, what you need to do is you will have to add a new configuration of proxy
set header host followed by a variable of host into the location directory of your configuration.
So we are back to our CLI setup and the first step is associated with our reverse proxy.
Second tab is associated with our backend application server.
Now in order to understand it in a better way, what we need to do in the application server, we have
to install the Tcpdump utility to capture the packets.
So let's go ahead and install the Tcpdump utility in the backend application server.
All right, now let's do one thing.
Let's go ahead and run the TCP dump here and from the reverse proxy server just to quickly revise,
we had set the host where whenever we query for the domain of labs dot internal, it goes to 127001.
So it basically goes to the local Nginx server, which is acting as a reverse proxy.
So now I will do a curl on CP labs dot internal.
So this request, since it is a reverse proxy server, it will be forwarded to the backend application
server here and the packets will be captured at the TCP dump level.
So now at a TCP dump level you will see ten packets have been captured and basically the file is temp
headers.
So let's quickly go to the temp directory and let's do a cat on headers.
So let's go a bit.
So this is basically the response, which is 200.
Okay.
But we are more interested in the actual request.
So if you look into the request, we have received a get request.
We are also getting the real IP of 127001.
And along with that, we are getting the host of ten one.
39 0.3, along with few other details over here.
But we are not really getting the actual domain that was queried upon.
And this is one of the reasons why you should go ahead and add an appropriate header.
So let's modify our configuration file.
I'll go to Etsy, Nginx conf dot d proxy dot conf.
And within here let's also add a new header.
I'll say proxy set header host followed by host over here.
All right, I'll save it.
We'll do next and we'll do a systemctl restart.
Nginx.
Perfect.
Now again from the application server, let's go ahead and clear the file of headers.
Let's run the tcpdump utility again and from a reverse proxy server let's do a curl on CP labs dot internal.
As expected, we are getting a response from the back end.
I'll do a control C, ten packets have been received.
Let's do a cat on headers.
Now.
If we go a bit up this time you'll see that you have a host header and this has a value of CP labs dot
internal and this is what we are discussing in today's video and this is very, very helpful in production
environments.
So it is generally from what I have seen, you have a host header as well as the real IP header.
Both of these are captured here.
Now one more important thing that I just wanted to show you, you can name it whatever you want.
Just to avoid any confusion, let me quickly show you let's modify this instead of host, you can give
whatever value you need.
Let me just give it as Z.
All right, let's quickly restart Nginx from the back end server.
Let's do a control C, we'll empty the file.
Let's do a TCP dump.
In fact, this will overwrite.
So you do not really need to explicitly empty the file here.
Now let's do a curl on CP labs dot internal.
Let's do a control C ten packet captured.
Let's do a cat on headers.
If you go a bit up this time you see for Z you are seeing CP labs dot internal.
So this field is completely modifiable depending upon your requirement.
And this time you also see that there is a new host which basically contains the IP address of the Nginx
reverse proxy.
Great.
So I hope with this you understood the basic problem and also its associated solution.
Now, one more thing I wanted to show you just to avoid any confusion is associated with the TCP dump
command.
So in this Tcpdump command, we are capturing the traffic of Port 80 that is coming to the interface
of one.
Now this is very important because in case if you are practicing it in a different cloud provider,
let me run ifconfig here.
So there are multiple interfaces that are present.
Now the Nginx reverse proxy server is sending the traffic to which interface is it sending the traffic
to the public IP which is associated with the zero interface?
Or is it sending the traffic to a private IP associated with the one interface and so on?
So if you want to quickly verify the reverse proxy is sending the data to IP ten 139 0.3 which is basically
this private interface over here.
So within this hyphen I you will have to specify the appropriate interface where the traffic is coming
from.
All right.
So this is one important part of the TCP dump command.
Great.
So with our basics understood for proxy host header, we'll conclude today's video.